2

I am trying to parse the following log-data:

[2016-Nov-12 13:15:17] [prog.HELP]: Some sample text, that causes some troubles. Please use module.html. Watch: https://wiki.buybite.org/display/FOP/Dash+mash+dust [] []

When I try to parse, I cannot parse inside square brackets. I've used this script:

%{YEAR}-%{MONTH}-%{MONTHDAY} %{HOUR}:?%{MINUTE}:%{SECOND} %\[{WORD}\]

But it didn't help at all. I have tried to check it on https://grokdebug.herokuapp.com/

baudsp
  • 4,076
  • 1
  • 17
  • 35
same fame name lame
  • 21
  • 2

1 Answers1

0

The expression did not work because there is a ] square bracket after seconds.

Your %\[{WORD}\] pattern is wrong, it matches %[{WORD}], as % cannot be torn away from the pattern name. You can use %{DATA} to obtain the contents between two brackets.

Use

%{YEAR}-%{MONTH}-%{MONTHDAY} %{HOUR}:?%{MINUTE}:%{SECOND}\] \[%{DATA}\]
Ryszard Czech
  • 18,032
  • 4
  • 24
  • 37